Analysis
-
max time kernel
153s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 06:18
Behavioral task
behavioral1
Sample
2f56038a57495ab5608e1c67f7dbd688.bin.exe
Resource
win7-20220812-en
General
-
Target
2f56038a57495ab5608e1c67f7dbd688.bin.exe
-
Size
8.7MB
-
MD5
2f56038a57495ab5608e1c67f7dbd688
-
SHA1
4da970efac6083ea26971c319671bcc2d6efd71a
-
SHA256
6acd081ddf2683294dc75bb6eecd6bad5480d822b425043f245daab1970a93d0
-
SHA512
12f1774ce6371fe1bcbee92107c46823694416e98068083e4d38c5a3381a4ca07b6d0895c6c09fb1c590fc20d9ed1e9928cedb6e0608a91c3addb4c9eee7520a
-
SSDEEP
196608:dDUIKAOLfrO/vgf8s3YLo71iEHj9kZVz/RV:dAIKRjrO/aILU1J9kx
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
Processes:
2f56038a57495ab5608e1c67f7dbd688.bin.exeivm31_protected.exeivm32_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 2f56038a57495ab5608e1c67f7dbd688.bin.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ivm31_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ ivm32_protected.exe -
Executes dropped EXE 2 IoCs
Processes:
ivm31_protected.exeivm32_protected.exepid process 4920 ivm31_protected.exe 5028 ivm32_protected.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2f56038a57495ab5608e1c67f7dbd688.bin.exeivm31_protected.exeivm32_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2f56038a57495ab5608e1c67f7dbd688.bin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2f56038a57495ab5608e1c67f7dbd688.bin.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ivm31_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ivm31_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ivm32_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion ivm32_protected.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/4364-132-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral2/memory/4364-133-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral2/memory/4364-134-0x0000000000400000-0x0000000001148000-memory.dmp themida behavioral2/memory/4364-136-0x0000000000400000-0x0000000001148000-memory.dmp themida C:\ProgramData\Gds\ivm31_protected.exe themida C:\ProgramData\Gds\ivm31_protected.exe themida behavioral2/memory/4920-140-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral2/memory/4920-141-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral2/memory/4920-142-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral2/memory/4920-143-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral2/memory/4920-146-0x0000000000400000-0x0000000000AF7000-memory.dmp themida C:\ProgramData\Gds\ivm32_protected.exe themida C:\ProgramData\Gds\ivm32_protected.exe themida behavioral2/memory/4920-152-0x0000000000400000-0x0000000000AF7000-memory.dmp themida behavioral2/memory/5028-151-0x0000000000A40000-0x00000000011B9000-memory.dmp themida behavioral2/memory/5028-154-0x0000000000A40000-0x00000000011B9000-memory.dmp themida behavioral2/memory/5028-155-0x0000000000A40000-0x00000000011B9000-memory.dmp themida behavioral2/memory/5028-156-0x0000000000A40000-0x00000000011B9000-memory.dmp themida behavioral2/memory/5028-157-0x0000000000A40000-0x00000000011B9000-memory.dmp themida behavioral2/memory/5028-158-0x0000000000A40000-0x00000000011B9000-memory.dmp themida behavioral2/memory/5028-159-0x0000000000A40000-0x00000000011B9000-memory.dmp themida behavioral2/memory/5028-160-0x0000000000A40000-0x00000000011B9000-memory.dmp themida behavioral2/memory/5028-161-0x0000000000A40000-0x00000000011B9000-memory.dmp themida behavioral2/memory/5028-162-0x0000000000A40000-0x00000000011B9000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
2f56038a57495ab5608e1c67f7dbd688.bin.exeivm31_protected.exeivm32_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2f56038a57495ab5608e1c67f7dbd688.bin.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ivm31_protected.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ivm32_protected.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 27 ip-api.com -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
Processes:
2f56038a57495ab5608e1c67f7dbd688.bin.exeivm31_protected.exeivm32_protected.exepid process 4364 2f56038a57495ab5608e1c67f7dbd688.bin.exe 4920 ivm31_protected.exe 5028 ivm32_protected.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
ivm32_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ivm32_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString ivm32_protected.exe -
Suspicious use of FindShellTrayWindow 12 IoCs
Processes:
ivm32_protected.exepid process 5028 ivm32_protected.exe 5028 ivm32_protected.exe 5028 ivm32_protected.exe 5028 ivm32_protected.exe 5028 ivm32_protected.exe 5028 ivm32_protected.exe 5028 ivm32_protected.exe 5028 ivm32_protected.exe 5028 ivm32_protected.exe 5028 ivm32_protected.exe 5028 ivm32_protected.exe 5028 ivm32_protected.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
2f56038a57495ab5608e1c67f7dbd688.bin.exedescription pid process target process PID 4364 wrote to memory of 4920 4364 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm31_protected.exe PID 4364 wrote to memory of 4920 4364 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm31_protected.exe PID 4364 wrote to memory of 4920 4364 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm31_protected.exe PID 4364 wrote to memory of 5028 4364 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm32_protected.exe PID 4364 wrote to memory of 5028 4364 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm32_protected.exe PID 4364 wrote to memory of 5028 4364 2f56038a57495ab5608e1c67f7dbd688.bin.exe ivm32_protected.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2f56038a57495ab5608e1c67f7dbd688.bin.exe"C:\Users\Admin\AppData\Local\Temp\2f56038a57495ab5608e1c67f7dbd688.bin.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Gds\ivm31_protected.exeC:\ProgramData\Gds\ivm31_protected.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\ProgramData\Gds\ivm32_protected.exeC:\ProgramData\Gds\ivm32_protected.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Gds\ivm31_protected.exeFilesize
2.8MB
MD52093bf0de6bc1a8763835f287b8784dc
SHA1a15bd81406d950f86120ae338125beb8e85923c4
SHA2560a429c131f5188ad77d4f453e5dbeca5f0e451c4dab3789fd2dce9467ba90b42
SHA512c86476e9c764921295eeed033217bf5e73cf508606b6f32968381da004828605dfb4c589abb712f46aa8b7648700bcdfa6699fdaf1d197c0d13ab68600213ed3
-
C:\ProgramData\Gds\ivm31_protected.exeFilesize
2.8MB
MD52093bf0de6bc1a8763835f287b8784dc
SHA1a15bd81406d950f86120ae338125beb8e85923c4
SHA2560a429c131f5188ad77d4f453e5dbeca5f0e451c4dab3789fd2dce9467ba90b42
SHA512c86476e9c764921295eeed033217bf5e73cf508606b6f32968381da004828605dfb4c589abb712f46aa8b7648700bcdfa6699fdaf1d197c0d13ab68600213ed3
-
C:\ProgramData\Gds\ivm32_protected.exeFilesize
3.0MB
MD5d061734e588fd7fdc40c6eb4dece2dbf
SHA1ff303916430955881bfc28b3f3ec7f237edd6c88
SHA25614a8f6dd57824fc552daddc145bc7492427fbde9ca3b96c1040f3d296e34921c
SHA512115d7824fa0eca30804bfc37b249f2d7b1b2b0424bb81fa8c2c2170de12ef80e28686b9a74a728760f14321d99d6b67b17b13926891f419b09ec8a16cf9ddc17
-
C:\ProgramData\Gds\ivm32_protected.exeFilesize
3.0MB
MD5d061734e588fd7fdc40c6eb4dece2dbf
SHA1ff303916430955881bfc28b3f3ec7f237edd6c88
SHA25614a8f6dd57824fc552daddc145bc7492427fbde9ca3b96c1040f3d296e34921c
SHA512115d7824fa0eca30804bfc37b249f2d7b1b2b0424bb81fa8c2c2170de12ef80e28686b9a74a728760f14321d99d6b67b17b13926891f419b09ec8a16cf9ddc17
-
memory/4364-145-0x0000000077DC0000-0x0000000077F63000-memory.dmpFilesize
1.6MB
-
memory/4364-133-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/4364-134-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/4364-135-0x0000000077DC0000-0x0000000077F63000-memory.dmpFilesize
1.6MB
-
memory/4364-136-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/4364-132-0x0000000000400000-0x0000000001148000-memory.dmpFilesize
13.3MB
-
memory/4920-140-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4920-152-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4920-144-0x0000000077DC0000-0x0000000077F63000-memory.dmpFilesize
1.6MB
-
memory/4920-142-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4920-146-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4920-143-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4920-141-0x0000000000400000-0x0000000000AF7000-memory.dmpFilesize
7.0MB
-
memory/4920-150-0x0000000077DC0000-0x0000000077F63000-memory.dmpFilesize
1.6MB
-
memory/4920-137-0x0000000000000000-mapping.dmp
-
memory/5028-153-0x0000000077DC0000-0x0000000077F63000-memory.dmpFilesize
1.6MB
-
memory/5028-151-0x0000000000A40000-0x00000000011B9000-memory.dmpFilesize
7.5MB
-
memory/5028-147-0x0000000000000000-mapping.dmp
-
memory/5028-154-0x0000000000A40000-0x00000000011B9000-memory.dmpFilesize
7.5MB
-
memory/5028-155-0x0000000000A40000-0x00000000011B9000-memory.dmpFilesize
7.5MB
-
memory/5028-156-0x0000000000A40000-0x00000000011B9000-memory.dmpFilesize
7.5MB
-
memory/5028-157-0x0000000000A40000-0x00000000011B9000-memory.dmpFilesize
7.5MB
-
memory/5028-158-0x0000000000A40000-0x00000000011B9000-memory.dmpFilesize
7.5MB
-
memory/5028-159-0x0000000000A40000-0x00000000011B9000-memory.dmpFilesize
7.5MB
-
memory/5028-160-0x0000000000A40000-0x00000000011B9000-memory.dmpFilesize
7.5MB
-
memory/5028-161-0x0000000000A40000-0x00000000011B9000-memory.dmpFilesize
7.5MB
-
memory/5028-162-0x0000000000A40000-0x00000000011B9000-memory.dmpFilesize
7.5MB
-
memory/5028-163-0x0000000077DC0000-0x0000000077F63000-memory.dmpFilesize
1.6MB